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AMENDMENTS TO THE CLAIMS 

1-9. (Canceled) 

1 0. (Currently amended) A method, comprising: 
receiving packets at the node; 

computing one or more signatures for each of the received packets; 

aggregating the computed one or more signatures in a first memory to produce one or more 
signature vectors , wherein the computed one or more signatures are aggregated over a collection 
interval R : 

archiving the one or more signature vectors in a second memory; [[and]] 
providing the archived one or more signature vectors to an agent for determining a point of 
ingress for the packet when it entered a networ k; and 

randomlv zeroing out a fraction of the one or more signature vectors that are older than P seconds . 

1 1 . (Original) The method of claim 10, wherein computing the one or more signatures for each 
of the received packets further comprises: 

computing one or more cyclical redundancy checking values for each of the received 
packets. 

12. (Original) The method of claim 10, wherein computing the one or more signatures for each 
of the received packets further comprises: 
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computing one or more hash values for each of the received packets. 

13. (Original) The method of claim 10, wherein computing the one or more signatures for each 
of the received packets further comprises: 

computing one or more CRC-32 values for each of the received packets. 

14. (Original) The method of claim 10, wherein the second memory comprises a ring buffer. 

15. (Canceled) 

16. (Currently amended) The method of claim iQ[[15]], wherein archiving the one or more 
signature vectors comprises: 

storing the one or more signature vectors in the second memory indexed by the collection 
interval. 

17. (Original) The method of claim 10, wherein archiving the one or more signature vectors 
comprises: 

storing a fraction of the one or more signature vectors in the second memory. 

18. (Original) The method of claim 10, further comprising: 

discarding signature vectors of the archived one or more signature vectors that are older than 
P seconds. 
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19. (Canceled) 

20. (Currently amended) The method of claim 10[[19]], further comprising: 
merging bits of the signature vectors that are older than P seconds. 

21 . (Original) The method of claim 20, further comprising: 

archiving the merged bits in the second memory for a period equaling a multiple of the 
collection interval R. 

22. (Original) The method of claim 2 1 , wherein the multiple of the collection interval R 
comprises 10*R. 

23. (Original) The method of claim 10, wherein the second memory comprises a DRAM. 

24. (Currently amended) An apparatus for archiving signatures associated with packets received 
at a node in a network, comprising: 

a first memory; 

a second memory; 

a signature tap configured to: 

receive packets at the node; 

compute one or more signatures for each of the received packets; 
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a multiplexer configured to: 

aggregate , over a collection interval R , the computed one or more signatures in the 
first memory to produce one or more signature vectors; and 

a controller configured to: 

archive the one or more signature vectors in the second memor y: and 

randomly zero out a fi-action of the one or more signature vectors that are older than 

P seconds . 

25. (Original) The apparatus of claim 24, the one or more signature vectors comprising one or 
more cyclical redundancy checking values. 

26. (Original) The apparatus of claim 24, the one or more signature vectors comprising one or 
more hash values. 

27. (Original) The apparatus of claim 24, the one or more signature vectors comprising one or 
more CRC-32 values. 

28. (Original) The apparatus of claim 24, wherein the second memory comprises a ring buffer. 

29. (Canceled) 

30. (Currently amended) The apparatus of claim 24[[29]], the controller further configured to: 
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Store the one or more signature vectors in the second memory indexed by the collection 
interval. 

3 1 . (Original) The apparatus of claim 24, the controller further configured to: 
store a fraction of the one or more signature vectors in the second memory. 

32. (Original) The apparatus of claim 24, the controller further configured to: 

discard signature vectors of the archived one or more signature vectors that are older than P 
seconds. 

33. (Canceled) 

34. (Currently amended) The apparatus of claim 24[[33]], the controller further configured to: 
merge bits of the signature vectors that are older than the P seconds. 

35. (Original) The apparatus of claim 34, the controller further configured to: 

archive the merged bits in the second memory for a period equaling a multiple of the 
collection interval R, 

36. (Original) The apparatus of claim 35, wherein the multiple of the collection interval R 
comprises 10*R. 
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37. (Original) The apparatus of claim 24, wherein the second memory comprises a DRAM. 

38. (Canceled) 

39. (Previously presented) A system, comprising: 
a first memory; 

a second memory; 

one or more signature taps configured to: 
receive packets at the node, and 

compute one or more signatures for each of the received packets; 
a multiplexer configured to: 

use each of the one or more signatures as addresses for addressing bit locations in the first 
memory, 

set memory bits in the addresses of the first memory corresponding to each of the one or 
more signatures; and 

a controller configured to archive a signature vector comprising a block of memory bits firom 
the first memory in the second memory. 

40. (Currently amended) A system, comprising: 
a first memory; 

a second memory; 
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a signature tap to determine at least one signatxire for each packet of a plurality of received 

packets; 

a multiplexer to store, over a collection interval, the determined at least one signature pack e t 
for each of the plurality of received packets in the first memory to produce a signature vector that 
comprises a block of a plurality of signatures for at least a portion of the plurahty of received 
packets; and 

a controller configured to archive the on e or more signature v e ctors vector in the second 
memory after an expiration of the collection interval. 

41. (New) The system of claim 40, the at least one signature comprising a cyclical redundancy 
checking value. 

42. (New) The system of claim 40, the at least one signature comprising a hash value. 

43. (New) The system of claim 40, the at least one signature comprising a CRC-32 value. 

44. (New) The system of claim 40, wherein the second memory comprises a ring buffer. 

45. (New) The system of claim 40, the controller further configured to: 

archive the one or more signature vectors in the second memory indexed by the collection 
interval. 
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46. (New) The system of claim 40, the controller further configured to: 

archive a fraction of the one or more signature vectors in the second memory. 



47. (New) The system of claim 40, the controller further configured to: 

discard signature vectors of the archived one or more signature vectors that are older than P 
seconds. 



48. (New) The system of claim 40, wherein the second memory comprises a DRAM. 
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